Generating Metrics for Networked Devices

ABSTRACT

Groups of network devices may be identified automatically based on interface tags associated with network device interfaces such that network devices within a group are automatically identified, periodically or otherwise, based on an association of one or more common interface tags between the group and the network device interface.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of U.S. application Ser. No.12/792,111, filed Jun. 2, 2010, which is a continuation of U.S.application Ser. No. 12/271,208, filed Nov. 14, 2008, which is nowissued as U.S. Pat. No. 7,739,370, which is a continuation of U.S.application Ser. No. 11/604,393, filed Nov. 27, 2006, which is nowissued as U.S. Pat. No. 7,461,145, which is a continuation of U.S.application Ser. No. 10/184,071, filed Jun. 28, 2002, which is nowissued as U.S. Pat. No. 7,143,158, which claims the benefit of andpriority to U.S. provisional application No. 60/356,124, filed Feb. 14,2002. Each of the aforementioned patent(s) and application(s) are herebyincorporated by reference in their entirety.

TECHNICAL FIELD

This invention relates to automating the aggregation of metrics formultiple network devices.

BACKGROUND OF THE INVENTION

LAN administrators and network engineers sometimes need to obtainmetrics for devices in their network, particularly with respect tonetwork traffic input and output by one or more network devices. Ifobtainable, these performance metrics serve several purposes. Forexample, they may be useful in evaluating internal network performanceand distribution of network traffic, enabling reconfiguration andoptimization of network resources. They also may be useful in monitoringtraffic communicated between the network devices and external devices orservices, enabling evaluation of (1) internal network resourceutilization and (2) external resource and service utilization by networkdevices.

In various applications, such as those described above, it often isdesirable to obtain performance metrics for a collection or group ofnetwork devices, which may or may not be physically proximate orotherwise grouped. For instance, to determine external device/serviceutilization by internal network devices, it may be necessary to obtainaggregate metrics for the logical grouping of network devicesinterfacing with and utilizing an external device/service. Similarly, todetermine network resource utilization by an external device/service, itmay be necessary to obtain aggregate metrics for network devices used tomake available the network resource.

Independent lists may be manually established and maintained to enablegrouping of devices or interfaces from which data is sought. However,because these lists are manually maintained, they often becomeincomplete or outdated.

SUMMARY

Groups of network devices may instead be identified automatically basedon electronic interface tags associated with network device interfacessuch that network devices within a group are automatically identified,periodically or otherwise, based on an association of one or more commoninterface tags between the group and the network device interface.

The details of one or more implementations are set forth in theaccompanying drawings and the description below. Other features will beapparent from the description and drawings, and from the claims.

DESCRIPTION OF DRAWINGS

FIG. 1 is a flow chart of a process for automatically aggregatingmetrics for more than one network device.

FIG. 2A is a flow chart of a process for identifying network resourcesavailable for aggregation.

FIG. 2B illustrates an example of an interface tag editor that can beused to create and edit interface tag definitions.

FIG. 3A is a flow chart of a process for automating the aggregation ofmetrics from identified network resources.

FIG. 3B illustrates a group editor that may be used to create andmaintain a group definitions table that relates group names to theirdefining tags.

FIG. 3C is a flow chart of a process for automatically aggregatingmetrics from network device interfaces having identified tags associatedtherewith.

FIGS. 3D and 3E illustrate history files that are useful for trackingtemporal changes in the association of interfaces to groups.

FIG. 4A is a report showing metrics for network devices that belong tothe group “peering-CW.”

FIGS. 4B and 4C illustrate a graphical representation of the data shownby FIG. 4A.

FIGS. 5A-5C illustrate billing and other financial and statisticalreports.

FIGS. 6A and 6B are block diagrams of a communications system forimplementing techniques described with respect to FIGS. 1-5C.

Like reference symbols in the various drawings indicate like elements.

DETAILED DESCRIPTION

Aggregation of metrics for network resources requires organization ofnetwork devices/resources. For example, to aggregate network trafficmetrics for all network devices utilizing an external resource, it maybe necessary to (1) identify the network devices utilizing the externalresource, and (2) measure traffic metrics at those devices attributableto usage of the external resource. More specific examples follow. If anonline service provider (OSP) is charged by its peers (e.g., Sprint)based on the traffic routed from the OSP to the peer, it is helpful toidentify all OSP network devices routing traffic to the peer and tomeasure the traffic metrics at those identified OSP network devices thatrepresent communications sent to the peer. Similarly, a group of networkdevices may be identified based on tags associated with interfacestherefore, and the “health” or error status of those devices can becollectively monitored. Where the group represents devices enabling allcommunications with another entity, the tags can be used to gather andmonitor statistics for communication with the entity.

Referring to FIG. 1, the process for automatically aggregating metricsfor more than one network device may include identifying networkresources for aggregation purposes (110), automating the aggregation ofmetrics from the identified resources (120), and generating an outputsuch as a report or strategic decision based on the aggregated results(130).

Referring to FIG. 2A, network resources available for aggregation may beidentified (110) by generating or accessing one or more interface tagsfor use (210) and by associating appropriate interface tags with networkdevice interfaces (220).

FIG. 2B illustrates an example of a interface tag editor that can beused to create and edit interface tag definitions (210). Using such atable, a list of available interface tags and their related descriptionsmay be maintained as a resource to be referenced when seeking toassociate consistent interface tags with network device interfaces.

Tags typically are associated with interfaces (220) for network devicesthat represent communication points with other network devices. Forinstance, rather than associating a tag with a router that uses severalblades to support connectivity to various devices, or even associating atag with an interface for a router blade that uses several ports tosupport connectivity to various devices, tags tend to be associated withthe lowest-level of network connectivity, the ports in this example.Below are examples of different line cards available for Cisco routers,each having at least one port that contains a tagable interface:

http://www.cisco.com/univercd/cc/td/doc/pcat/qoc48_(—)11.htm,

http://www.cisco.com/univercd/cc/td/doc/pcat/oc12_(—)12.htm,

http://www.cisco.com/univercd/cc/td/doc/pcat/gget_(—)13.htm,

http://www.cisco.com/univercd/cc/td/doc/pcat/gget_(—)11.htm, and

http://www.cisco.com/univercd/cc/td/doc/pcat/oc3stml1.htm.

As will be better understood when groupings are discussed with respectto step 120, by associating tags with network device interfacesrepresenting a low (e.g., perhaps the lowest level) of connectivity,tags associated with a particular network device may be modified usingthe interface accessed by technicians charged with configuring orreconfiguring that network device, increasing the likelihood thatnetwork configuration changes will be documented in a meaningful andtimely manner.

A dedicated field may be provided in a network device interface forstorage of tags. Alternatively, tags may be stored by network deviceinterface fields designed for other purposes, and may supplant, replaceor supplement data in those fields (e.g., notes or title). Whensupplementing other data, a tag identifier (e.g., “T”) or protocol(e.g., “T=tag name”) may be used to distinguish the tag from the otherdata in the field.

Below are examples of several instances of tags inserted into andsupplementing data within the if Descr interface description SNMP(Simple Network Management Protocol) variable field, which is a variablefield under the SNMP that is contained within the network interface toallow users to input any type of field (e.g., a notes field). In theseexamples, the tag is distinguished from other data within the titlefield using a tag identifier (“T”) and a tag identifying protocol(“(T=tag name)”).

ifDescr field. Device Name & Interface The tag is the part marked as (T= . . . ) pop1-sun.atdn.net, POS0/3, pop1-sun-P0-3-CandW(204.172.156.68/ 30 CandW:1538408) (T = pCW) pop2-dal.atdn.net, POS2/0,pop2-dal-p2-0-C&W (204.172.138.128/ 30 CW:1495797) (T = pCW)pop2-nye.atdn.net, POS3/0, pop2-nye-P3-0-CandW (202.24.207.216/ 30CW:1497391) (T = pCW) pop2-loh.atdn.net, POS7/0, pop2-loh-P7-0-CandW(199.811.180/ 30 CW:p20484a) (T = pCWDIAL) pop3-vie.atdn.net, POS0/0,pop3-vie-P0-0-CandW (202.24.238.88/ 30 CW:1509667) (T = pCW)pop4-vie.atdn.net, POS7/0, pop4-vie-P7-0-CW (204.173.155.128/ 30SIGMA:jk1001, CW:1475509) (T = pCW)

As demonstrated by the above examples, tags are distinct frominformation ordinarily provided on the network device interface in thatthey typically are generic as to device attributes such as IP addressand title. Generally, a single tag is associated with each networkdevice interface since each interface typically communicates with anidentifiable category of network device for purposes of tagging.However, to the extent that a network device communicates with more thanone other category of network device (e.g., peer Sprint in the aboveexample) for purposes of tagging, multiple tags may be associated withthe interface for that network device, and traffic through that networkdevice may or may not be apportioned among the different tags associatedtherewith. For instance, refined searching may be enabled by associatingmultiple tags to one or more particular interfaces.

Furthermore, an associated multiplier may be associated with each tag ofan interface having multiple associated tags to reflect or appropriatelyapportion traffic attributable to each tag. Similarly, to the extentthat data from one device interface is needed by several reports, theinterface tag may be associated with each of those reports byreferencing its groups, as will be understood more clearly withreferences to the description of step 120.

To preserve memory while enabling recognizable string names to be usedfor tags, tag names may be reformatted prior to storage. For instance, atag name having a space may be reformatted to remove this space prior tostorage. In this manner, when subsequent searches are performed for thetag name, the query tag should also be modified to remove spaces.

Referring to FIG. 3A, the aggregation and metrics from the identifiednetwork resources may be automated (120) by identifying one or more tagsfor aggregation (310) and aggregating the metrics from the networkdevice interfaces having identical tags associated therewith (320).

Tags may be identified for aggregation (310) in response to user input.For instance, a user may be provided an interface through whichselections of tags may be made manually. Alternatively, a selected listor all of the tags may be pre-identified for automatic processing. Inany event, tags may be used to define groups of network deviceinterfaces and thus network devices. Furthermore, one or more tags maythemselves be grouped. For instance, FIG. 3B illustrates a group editorthat may be used to create and maintain a group definitions table thatrelates group names to their defining tags. Various levels of access maybe provided to such a table (e.g., viewing versus modifying).

Referring to FIG. 3C, the metrics from network device interfaces havingidentified tags associated therewith may be automatically aggregated(320) by generating metrics for each of the network devices having a tagspecified by a group of interest (320A) and compiling metrics for thegroup of network devices and/or individual network devices within theaggregated group (320B).

The aggregation of metrics for network devices typically accounts forthe particular period of time that a network device includes the tag ofinterest. For instance, during the process of FIG. 3C, metrics aregenerated for each of the network devices during the period of time inwhich those devices had an identified tag associated therewith (320A).Thus, the metrics compiled for any particular group of aggregatednetwork devices may reflect activities of those individual devicesduring only the time period for which the individual devices haveinterface tags defined by the group.

To enable accurate reporting of temporal associations between tags andinterfaces, and hence between network devices and groups, timinginformation may be maintained regarding the tag/interface relationship.Specifically, in one implementation, a “history” file is maintained at aserver to enable tracking of the addition/removal of tags to/frominterfaces, or of interfaces to/from groups based on changes in theassociation of tags to interfaces, or the association of tags tointerfaces, or the association of tags to groups. This history file maybe populated through manual investigations, routine/periodicinvestigations (e.g., hourly, daily, etc.), or event-triggeredinvestigations (e.g., based on the occurrence of change) of networkdevice interface status. Hence, changes in interface tags that occurbetween reports may be detected, recorded and accounted for.

FIGS. 3D and 3E illustrate history files that are useful for trackingtemporal changes in the association of interfaces to groups. In FIG. 3D,device interfaces within a group are listed with information reflectingthe first and last temporal association with the group, and in FIG. 3E,the “+” and “−” symbols are used to represent the addition to or removalof an interface from a group at a recorded date (UNIX code, e.g.,986928634=041 02001−1850 GMT/04102001−1450 LOCAL). But other historyfiles also may be useful, such as a history file showing temporalchanges in the association of tags with interfaces, from which groupchanges could be extrapolated. In addition, periodic investigations maybe avoided by storing historical information regarding tag changes atthe interface itself, and merely uploading or otherwise accessing suchinformation when aggregating metrics for network devices.

Thus, a report may be generated (130) to reflect metrics for eachnetwork device having an interface tag specified by a particular groupof interest. FIG. 4A shows metrics for network devices that belong tothe group “peering-CW”, and includes summary information for this groupin its first two lines. This report is generated with reference torecorded historical timing information, e.g., see FIG. 3D. As such,metrics for interfaces within the report are sometimes omitted,reflecting that this group's tag was not associated with the particularinterface during certain periods covered by the report. For instance,the FIG. 4A report contains data corresponding to the FIG. 3D historicaltiming data in that the metrics for pop1-ash.atdn.net, POS13/0 areomitted from the report until that interface was tagged on Tuesday the5^(th) (410), and the metrics for pop1-ntc.atdn.net, POS0/0 are omittedfrom the report after that interface was no longer associated with thegroup tag on Thursday the 7^(th) (420).

FIGS. 4B and 4C illustrate a graphical representation of the data shownby FIG. 4A and therefore also may be used to identify the present orabsence of a network device within the group over a period of time. Seereference numerals 430 and 440 corresponding to the addition ofpop1-ash.atdn.net, POS13/0 InBps on Tuesday the 5^(th).

And, as illustrated by FIGS. 5A-5C, billing and other financial andstatistical reports may be generated based on the metrics of groups, toenable strategic decision-making and record keeping.

For illustrative purposes, FIGS. 6A and 6B describe a communicationssystem for implementing techniques described with respect to FIGS. 1-5C.For brevity, several elements in the figures described below arerepresented as monolithic entities. However, as would be understood byone skilled in the art, these elements each may include numerousinterconnected computers and components designed to perform a set ofspecified operations and/or dedicated to a particular geographicalregion.

Referring to FIG. 6A, a communications system 600 is capable ofdelivering and exchanging data between a client system 605 and a hostsystem 610 through a communications link 615. The client system 605typically includes one or more client devices 620 and/or clientcontrollers 625, and the host system 610 typically includes one or morehost devices 635 and/or host controllers 640. For example, the clientsystem 605 or the host system 610 may include one or moregeneral-purpose computers (e.g., personal computers), one or morespecial-purpose computers (e.g., devices specifically programmed tocommunicate with each other and/or the client system 605 or the hostsystem 610), or a combination of one or more general-purpose computersand one or more special-purpose computers. The client system 605 and thehost system 610 may be arranged to operate within or in concert with oneor more other systems, such as, for example, one or more LANs (“LocalArea Networks”) and/or one or more WANs (“Wide Area Networks”). Theclient device 620 (or the host device 635) is generally capable ofexecuting instructions under the command of a client controller 625 (ora host controller 640). The client device 620 (or the host device 635)is connected to the client controller 625 (or the host controller 640)by a wired or wireless data pathway 630 or 645 capable of deliveringdata.

The client device 620, the client controller 625, the host device 635,and the host controller 640 each typically include one or more hardwarecomponents and/or software components. An example of a client device 620or a host device 635 is a general-purpose computer (e.g., a personalcomputer) capable of responding to and executing instructions in adefined manner. Other examples include a special-purpose computer, aworkstation, a server, a device, a component, other physical or virtualequipment or some combination thereof capable of responding to andexecuting instructions.

An example of client controller 625 or a host controller 640 is asoftware application loaded on the client device 620 or the host device635 for commanding and directing communications enabled by the clientdevice 620 or the host device 635. Other examples include a program, apiece of code, an instruction, a device, a computer, a computer system,or a combination thereof, for independently or collectively instructingthe client device 620 or the host device 635 to interact and operate asdescribed. The client controller 625 and the host controller 640 may beembodied permanently or temporarily in any type of machine, component,physical or virtual equipment, storage medium, or propagated signalcapable of providing instructions to the client device 620 or the hostdevice 635.

The communications link 615 typically includes a delivery network 660making a direct or indirect communication between the client system 605and the host system 610, irrespective of physical separation. Examplesof a delivery network 660 include the Internet, the World Wide Web,WANs, LANs, analog or digital wired and wireless telephone networks(e.g., PSTN, ISDN, and xDSL), radio, television, cable, satellite,and/or any other delivery mechanism for carrying data. Thecommunications link 615 may include communication pathways 650, 655 thatenable communications through the one or more delivery networks 660described above. Each of the communication pathways 650, 655 mayinclude, for example, a wired, wireless, cable or satellitecommunication pathway.

FIG. 6B illustrates a communication system 600 including a client system605 communicating with a host system 610 through a communications link615. Client system 605 typically includes one or more client devices 620and one or more client controllers 625 for controlling the clientdevices 620. Host system 610 typically includes one or more host devices635 and one or more host controllers 640 for controlling the hostdevices 635. The communications link 615 may include communicationpathways 650, 655 enabling communications through the one or moredelivery networks 660.

Examples of each element within the communication system of FIG. 6B arebroadly described above with respect to FIG. 6A. In particular, the hostsystem 610 and the communications link 615 of FIG. 6B typically haveattributes comparable to those described with respect to the host system610 and the communications link 615 of FIG. 6A, respectively. Likewise,the client system 605 of FIG. 6B typically has attributes comparable to,and may illustrate one possible embodiment of, the client system 605 ofFIG. 6.

The client device 620 typically includes a general purpose computer 670having an internal or external storage 672 for storing data and programssuch as an operating system 674 (e.g., DOS, Windows®, Windows® 95,Windows® 98, Windows® 2000, Windows® NT, Windows® Millennium Edition,Windows® XP, OS/2, UNIX and Linux) and one or more application programs.Examples of application programs include authoring applications 676(e.g., word processing, database programs, spreadsheet programs,presentation programs, and graphics programs) capable of generatingdocuments or other electronic content; client applications 678 (e.g.,AOL client, CompuServe client, AIM client, AOL TV client, and ISPclient) capable of communicating with other computer users, accessingvarious computer resources, and viewing, creating, or otherwisemanipulating electronic content; and browser applications 680 (e.g.,Netscape's Navigator and Microsoft's Internet Explorer) capable ofrendering standard Internet content.

The general-purpose computer 670 also includes a central processing unit682 (CPU) for executing instructions in response to commands from theclient controller 625. In one implementation, the client controller 625includes one or more of the application programs installed on theinternal or external storage 672 of the general-purpose computer 670. Inanother implementation, the client controller 625 includes applicationprograms externally stored in and executed by one or more device(s)external to the general-purpose computer 670.

The general-purpose computer typically will include a communicationdevice 684 for sending and receiving data. One example of thecommunication device 684 is a modem. Other examples include atransceiver, a set-top box, a communication card, a satellite dish, anantenna, or another network adapter capable of transmitting andreceiving data over the communications link 615 through a wired orwireless data pathway 650. The general-purpose computer 670 also mayinclude a TV (“television”) tuner 686 for receiving televisionprogramming in the form of broadcast, satellite, and/or cable TVsignals. As a result, the client device 620 can selectively and/orsimultaneously display network content received by communications device684 and television programming content received by the TV tuner 686.

The general-purpose computer 670 typically will include an input/outputinterface 688 to enable a wired or wireless connection to variousperipheral devices 690. Examples of peripheral devices 690 include, butare not limited to, a mouse 691, a mobile phone 692, a personal digitalassistant 693 (PDA), a keyboard 694, a display monitor 695 with orwithout a touch screen input, and/or a TV remote control 696 forreceiving information from and rendering information to subscribers.Other examples may include voice recognition and synthesis devices.

Although FIG. 6B illustrates devices such as a mobile telephone 692, aPDA 693, and a TV remote control 696 as being peripheral with respect tothe general-purpose computer 670, in another implementation, suchdevices may themselves include the functionality of the general-purposecomputer 670 and operate as the client device 620. For example, themobile phone 692 or the PDA 693 may include computing and networkingcapabilities, and may function as a client device 620 by accessing thedelivery network 660 and communicating with the host system 610.Furthermore, the client system 605 may include one, some, all, or noneof the components and devices described above.

As described above, interface tags can be used to group network deviceinterfaces and hence as a means for enabling monitoring of aggregatedstatistics for a group of network devices having one or more sharedattributes. As such, interface tags may be used as a substitute for, orin combination with, one or more network device or network deviceinterface attributes, examples of attributes for a network deviceincluding speed, communication interface type (e.g., POS, serialethernet, fast ethernet, ATM), device manufacturer type, router type,interface name, description, packet size, Interface IP, Network name,Network Mask, and/or location.

A number of implementations have been described. Nevertheless, it willbe understood that various modifications may be made. Accordingly, otherimplementations are within the scope of the following claims.

What is claimed is:
 1. A method for generating network traffic metricsfor a group of network devices, comprising: causing association of tagswith interfaces representing network devices that belong to multiple,different groups of network devices, each tag identifying at least oneof the multiple, different groups of network devices; identifying aparticular tag that corresponds to and enables monitoring of aparticular group of network devices included in the multiple, differentgroups of network devices; identifying, from among the interfacesassociated with the tags, a subset of the interfaces that wereassociated with the particular tag that corresponds to and enablesmonitoring of the particular group of network devices; accessing networktraffic metrics measured for each interface included in the identifiedsubset of the interfaces that were associated with the particular tag;aggregating the accessed network traffic metrics to determine collectivenetwork traffic metrics for the particular group of network devices; andstoring data representing the collective network traffic metricsdetermined for the particular group of network devices based on theaggregation of the accessed network traffic metrics.
 2. The method ofclaim 1, wherein accessing network traffic metrics measured for eachinterface included in the identified subset of the interfaces that wereassociated with the particular tag comprises accessing usage datadescribing usage of an external resource measured for each interfaceincluded in the identified subset of the interfaces that were associatedwith the particular tag.
 3. The method of claim 1, wherein accessingnetwork traffic metrics measured for each interface included in theidentified subset of the interfaces that were associated with theparticular tag comprises gathering statistics for communication with anentity for each interface included in the identified subset of theinterfaces that were associated with the particular tag.
 4. The methodof claim 1, wherein causing association of tags with interfacesrepresenting network devices that belong to multiple, different groupsof network devices comprises causing association of tags with networkcommunication ports that represent a lowest level of networkconnectivity for the network devices.
 5. The method of claim 1, whereincausing association of tags with interfaces representing network devicesthat belong to multiple, different groups of network devices comprisesstoring a tag in a network device interface field designed for otherpurposes and including a tag identifier in the network device interfacefield to distinguish the tag from other data in the network deviceinterface field.
 6. The method of claim 1, wherein causing associationof tags with interfaces representing network devices that belong tomultiple, different groups of network devices comprises causingassociation of multiple, different tags with a single interfacerepresenting a network device and apportioning network traffic throughthe single interface among the multiple, different tags associated withthe single interface.
 7. The method of claim 6, wherein apportioningnetwork traffic through the single interface among the multiple,different tags associated with the single interface comprises usingmultipliers corresponding to the multiple, different tags to apportionthe network traffic through the single interface among the multiple,different tags associated with the single interface.
 8. The method ofclaim 1, wherein causing association of tags with interfacesrepresenting network devices that belong to multiple, different groupsof network devices comprises reformatting a tag associated with aninterface of a network device prior to storage of the tag.
 9. The methodof claim 8, wherein identifying, from among the interfaces associatedwith the tags, the subset of the interfaces that were associated withthe particular tag that corresponds to and enables monitoring of theparticular group of network devices comprises reformatting theparticular tag in a query used to identify the subset of the interfacesthat were associated with the particular tag that corresponds to andenables monitoring of the particular group of network devices.
 10. Themethod of claim 1, wherein causing association of tags with interfacesrepresenting network devices that belong to multiple, different groupsof network devices comprises maintaining a history file that trackstiming data describing addition of tags to interfaces and removal oftags from interfaces.
 11. A system including at least one processorconfigured to perform operation comprising: causing association of tagswith interfaces representing network devices that belong to multiple,different groups of network devices, each tag identifying at least oneof the multiple, different groups of network devices; identifying aparticular tag that corresponds to and enables monitoring of aparticular group of network devices included in the multiple, differentgroups of network devices; identifying, from among the interfacesassociated with the tags, a subset of the interfaces that wereassociated with the particular tag that corresponds to and enablesmonitoring of the particular group of network devices; accessing networktraffic metrics measured for each interface included in the identifiedsubset of the interfaces that were associated with the particular tag;aggregating the accessed network traffic metrics to determine collectivenetwork traffic metrics for the particular group of network devices; andstoring data representing the collective network traffic metricsdetermined for the particular group of network devices based on theaggregation of the accessed network traffic metrics.
 12. The system ofclaim 11, wherein accessing network traffic metrics measured for eachinterface included in the identified subset of the interfaces that wereassociated with the particular tag comprises accessing usage datadescribing usage of an external resource measured for each interfaceincluded in the identified subset of the interfaces that were associatedwith the particular tag.
 13. The system of claim 11, wherein accessingnetwork traffic metrics measured for each interface included in theidentified subset of the interfaces that were associated with theparticular tag comprises gathering statistics for communication with anentity for each interface included in the identified subset of theinterfaces that were associated with the particular tag.
 14. The systemof claim 11, wherein causing association of tags with interfacesrepresenting network devices that belong to multiple, different groupsof network devices comprises causing association of tags with networkcommunication ports that represent a lowest level of networkconnectivity for the network devices.
 15. The system of claim 11,wherein causing association of tags with interfaces representing networkdevices that belong to multiple, different groups of network devicescomprises storing a tag in a network device interface field designed forother purposes and including a tag identifier in the network deviceinterface field to distinguish the tag from other data in the networkdevice interface field.
 16. The system of claim 11, wherein causingassociation of tags with interfaces representing network devices thatbelong to multiple, different groups of network devices comprisescausing association of multiple, different tags with a single interfacerepresenting a network device and apportioning network traffic throughthe single interface among the multiple, different tags associated withthe single interface.
 17. The system of claim 16, wherein apportioningnetwork traffic through the single interface among the multiple,different tags associated with the single interface comprises usingmultipliers corresponding to the multiple, different tags to apportionthe network traffic through the single interface among the multiple,different tags associated with the single interface.
 18. The system ofclaim 11, wherein causing association of tags with interfacesrepresenting network devices that belong to multiple, different groupsof network devices comprises reformatting a tag associated with aninterface of a network device prior to storage of the tag.
 19. Thesystem of claim 18, wherein identifying, from among the interfacesassociated with the tags, the subset of the interfaces that wereassociated with the particular tag that corresponds to and enablesmonitoring of the particular group of network devices comprisesreformatting the particular tag in a query used to identify the subsetof the interfaces that were associated with the particular tag thatcorresponds to and enables monitoring of the particular group of networkdevices.
 20. The system of claim 11, wherein causing association of tagswith interfaces representing network devices that belong to multiple,different groups of network devices comprises maintaining a history filethat tracks timing data describing addition of tags to interfaces andremoval of tags from interfaces.